Lucene search

CiscoCVE-2017-12316

HistoryNov 16, 2017 - 7:29 a.m.

CVE-2017-12316

2017-11-1607:29:00

CWE-307

CWE-287

cisco

web.nvd.nist.gov

cisco

ise

vulnerability

guest portal

cve-2017-12316

nvd

remote attacker

brute-force

password attacks

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

50.4%

JSON

A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform multiple login attempts in excess of the configured login attempt limit. The vulnerability is due to insufficient server-side login attempt limit enforcement. An attacker could exploit this vulnerability by sending modified login attempts to the Guest Portal login page. An exploit could allow the attacker to perform brute-force password attacks on the ISE Guest Portal. Cisco Bug IDs: CSCve98518.

Affected configurations

Nvd

Node

ciscoidentity_services_engine_softwareMatch2.1\(0.229\)

VendorProductVersionCPE
ciscoidentity_services_engine_software2.1(0.229)cpe:2.3:a:cisco:identity_services_engine_software:2.1\(0.229\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	identity_services_engine_software	2.1(0.229)	cpe:2.3:a:cisco:identity_services_engine_software:2.1\(0.229\):::::::*

CNA Affected

[
  {
    "product": "Cisco Identity Services Engine",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Identity Services Engine"
      }
    ]
  }
]

References

www.securityfocus.com/bid/101931

www.securitytracker.com/id/1039830

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-ise

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

50.4%

JSON

Related for CVE-2017-12316